checkId: check.environment.network.policy plugin: stellaops.doctor.environment severity: warn tags: [environment, network, policy, security, isolation]

Environment Network Policy

This stella doctor check evaluates the network-isolation posture of each managed environment so operators can catch insecure cross-environment exposure before it becomes an audit finding or an attack path into production.

What It Checks

Retrieves network policies from the Release Orchestrator (/api/v1/environments/network-policies) and evaluates isolation posture for each environment. The check enforces these rules:

Severity:

Why It Matters

Network isolation between environments is a fundamental security control. Allowing dev-to-production ingress means compromised development infrastructure can directly attack production services. Missing default-deny policies mean any new service added to the environment is implicitly network-accessible. Wildcard ingress exposes services to the entire network or internet. These misconfigurations are common audit findings that can block compliance certifications.

Common Causes

How to Fix

stella env network-policy … does not exist. Verified 2026-07-28 against the built CLI: stella env network-policy list exits 2 with Unrecognized command or argument 'env'. No env/environment command is registered at any depth, and no alias in src/Cli/StellaOps.Cli/cli-routes.json maps the token. Earlier revisions published list, create … --default-deny, and update … --allow-from/--egress-allow as remediation steps; all were fabricated.

Network isolation is enforced by the substrate — Compose networks, host firewall rules, or Kubernetes NetworkPolicy objects, as shown below. Environment-level policy configuration is a Console/API surface. Tracked as CLI-2 in docs/implplan/SPRINT_20260727_003_Cli_release_environment_command_surface.md.

Docker Compose

# Review what the check found
stella doctor run --check check.environment.network.policy --format json

# In Docker Compose, use network isolation
# Define separate networks in docker-compose.stella-ops.yml:
#   networks:
#     prod-internal:
#       internal: true
#     staging-internal:
#       internal: true

Bare Metal / systemd

# Review current iptables/nftables rules
sudo iptables -L -n -v
# or
sudo nft list ruleset

# Apply default-deny for production network interface
sudo iptables -A INPUT -i prod0 -j DROP
sudo iptables -I INPUT -i prod0 -s <staging-subnet> -j ACCEPT

# Persist firewall rules
sudo netfilter-persistent save

Kubernetes / Helm

# Review existing network policies
kubectl get networkpolicies -n stellaops-prod

# Apply default-deny via Helm
helm upgrade stellaops stellaops/stellaops \
  --set environments.prod.networkPolicy.defaultDeny=true \
  --set environments.prod.networkPolicy.allowFrom[0]=stellaops-staging

# Or apply a NetworkPolicy manifest directly
cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: stellaops-prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
EOF

Verification

stella doctor run --check check.environment.network.policy